Troubleshooting practice questions

Refer to the exhibit. You are troubleshooting an issue where several users are unable to change their passwords, and the help desk is seeing inconsistent results when resetting them. Based on the output provided, which domain controller should you investigate first for potential failures or connectivity issues?

Exhibit

Get-ADDomain | Select-Object InfrastructureMaster, PDCEmulator, RIDMaster

InfrastructureMaster : DC2.contoso.com
PDCEmulator          : DC1.contoso.com
RIDMaster             : DC1.contoso.com

Trap 1: DC2

DC2 holds the Infrastructure Master role, which manages cross-domain object references. While important for multi-domain environments, it plays no direct role in the password change process or the immediate processing of account lockouts, which are tasks specifically assigned to the PDC Emulator role holder.

Trap 2: The Schema Master

The Schema Master is a forest-wide role not listed in the domain-level exhibit output provided. It is responsible for structural changes to the Active Directory database and has no involvement in daily user account operations like password resets or the enforcement of account lockout policies.

Trap 3: The Domain Naming Master

The Domain Naming Master manages the addition and removal of domains within the forest. It is not involved in user-level authentication or password management. Issues with this role would prevent architectural changes to the forest but would not cause the password reset symptoms described in the scenario.

A
DC2
Why wrong: DC2 holds the Infrastructure Master role, which manages cross-domain object references. While important for multi-domain environments, it plays no direct role in the password change process or the immediate processing of account lockouts, which are tasks specifically assigned to the PDC Emulator role holder.
B
DC1
DC1 holds the PDC Emulator role, which is the primary domain controller for handling password updates and synchronization. When a user changes their password, the change is preferred to be processed by the PDC Emulator to ensure immediate consistency across the domain for authentication requests.
C
The Schema Master
Why wrong: The Schema Master is a forest-wide role not listed in the domain-level exhibit output provided. It is responsible for structural changes to the Active Directory database and has no involvement in daily user account operations like password resets or the enforcement of account lockout policies.
D
The Domain Naming Master
Why wrong: The Domain Naming Master manages the addition and removal of domains within the forest. It is not involved in user-level authentication or password management. Issues with this role would prevent architectural changes to the forest but would not cause the password reset symptoms described in the scenario.

Question 2hardmultiple choice

Refer to the exhibit. You are troubleshooting a replication issue between the Head Office (Site-HQ) and a Branch Office (Site-Branch-A). Based on the output, what is the most likely cause of the failure?

Exhibit

C:\> repadmin /showrepl

Site-Branch-A\DC-02
DSA Options: IS_GC
Site Options: (none)
DSA object GUID: 4a2b3c4d-5e6f...

==== INBOUND NEIGHBORS =====================================

DC=contoso,DC=com
    Site-HQ\DC-01 via RPC
        DSA object GUID: 1a2b3c4d-...
        Last attempt @ 2023-10-25 10:15:22 failed, result 1722 (0x6ba):
        The RPC server is unavailable.

Trap 1: The KCC has not yet generated a replication topology for the site.

If the Knowledge Consistency Checker (KCC) had not generated a topology, there would be no inbound neighbor listed in the repadmin output. The fact that DC-01 is listed as a neighbor indicates that the topology exists, but the actual attempt to synchronize data over that connection is failing due to communication errors.

Trap 2: There is a mismatch in the Site Link costs between the two sites.

Site Link costs determine the preferred path for replication but do not cause RPC server unavailable errors. A cost mismatch might lead to replication taking an inefficient route, but it would not prevent the RPC service from being reached if a valid network path and proper firewall rules were in place.

Trap 3: The destination domain controller lacks the Global Catalog role.

The exhibit explicitly shows 'DSA Options: IS_GC' for DC-02, confirming it is a Global Catalog. Even if it were not a GC, the absence of the role would not cause an RPC error during standard domain partition replication. RPC errors are strictly related to the underlying communication layer between the two servers.

A
The KCC has not yet generated a replication topology for the site.
Why wrong: If the Knowledge Consistency Checker (KCC) had not generated a topology, there would be no inbound neighbor listed in the repadmin output. The fact that DC-01 is listed as a neighbor indicates that the topology exists, but the actual attempt to synchronize data over that connection is failing due to communication errors.
B
There is a mismatch in the Site Link costs between the two sites.
Why wrong: Site Link costs determine the preferred path for replication but do not cause RPC server unavailable errors. A cost mismatch might lead to replication taking an inefficient route, but it would not prevent the RPC service from being reached if a valid network path and proper firewall rules were in place.
C
The destination domain controller lacks the Global Catalog role.
Why wrong: The exhibit explicitly shows 'DSA Options: IS_GC' for DC-02, confirming it is a Global Catalog. Even if it were not a GC, the absence of the role would not cause an RPC error during standard domain partition replication. RPC errors are strictly related to the underlying communication layer between the two servers.
D
A firewall is blocking RPC traffic or the source DC is offline.
The 'RPC server is unavailable' error is a classic indicator that the destination DC cannot establish a network connection to the RPC endpoint on the source DC. This is frequently caused by network firewalls, the source server being powered off, or critical services like the RPC Endpoint Mapper being blocked or stopped.

Read the full DNS explanation →

Question 3mediummulti select

You are troubleshooting a Windows Server DNS environment where stale resource records are not being removed, leading to name resolution errors. Which THREE conditions must be met for DNS scavenging to successfully delete a stale record?

Trap 1: The record must be a static record with a zero timestamp.

Static records with a timestamp of zero are actually protected from scavenging. Scavenging only applies to dynamic records that have a non-zero timestamp, which indicates when the record was last refreshed. This prevents critical manually-created infrastructure records from being deleted by the automated cleanup process.

Trap 2: The DNS server must be a member of the Schema Admins group.

DNS scavenging is a local service operation and does not require high-level Active Directory permissions like Schema Admins. The DNS service runs under the computer account or a service account which already has the necessary permissions to manage records within the Active Directory-integrated DNS zones it hosts.

A
Scavenging must be enabled at the DNS server level.
Even if individual zones are configured for scavenging, the master switch at the DNS server level must be turned on. This setting tells the DNS service to periodically run the scavenging algorithm and check all hosted zones for records that have exceeded their aging and refresh intervals.
B
Scavenging and aging must be enabled at the specific zone level.
Each DNS zone must be explicitly configured to allow aging and scavenging. This provides granular control, allowing administrators to protect static zones from accidental record deletion while ensuring that dynamic zones, which often contain temporary DHCP-assigned records, are regularly cleaned of obsolete entries that are no longer valid.
C
The record must be a static record with a zero timestamp.
Why wrong: Static records with a timestamp of zero are actually protected from scavenging. Scavenging only applies to dynamic records that have a non-zero timestamp, which indicates when the record was last refreshed. This prevents critical manually-created infrastructure records from being deleted by the automated cleanup process.
D
The record must have existed past the sum of the No-refresh and Refresh intervals.
A record is only considered stale after the No-refresh interval and the Refresh interval have both lapsed without the client updating its record. This combined duration ensures that the client has had ample opportunity to renew its lease and update its DNS information before the server deletes it.
E
The DNS server must be a member of the Schema Admins group.
Why wrong: DNS scavenging is a local service operation and does not require high-level Active Directory permissions like Schema Admins. The DNS service runs under the computer account or a service account which already has the necessary permissions to manage records within the Active Directory-integrated DNS zones it hosts.

Question 4hardmulti select

You are preparing to use the Storage Migration Service to migrate data from several Windows Server 2012 R2 servers. Which THREE components are essential parts of the Storage Migration Service architecture?

Trap 1: Azure Relay

Azure Relay is a service used for hybrid connectivity but is not a required component of the core Storage Migration Service architecture. While migrations can occur to Azure VMs, the service itself operates using standard network protocols between the orchestrator, source, and destination without needing a relay.

Trap 2: iSCSI Target Server

An iSCSI Target Server provides block-level storage over the network, but it is not a requirement for the Storage Migration Service. The service operates at the file and share level, using SMB to move data between systems regardless of the underlying physical or network storage technology.

A
Orchestrator server
The orchestrator is a Windows Server 2019 or 2022 machine that runs the Storage Migration Service proxy. it manages the entire migration job, including inventorying the source, transferring the data, and performing the final cutover where identities are moved from the source to the destination.
B
Source server
The source server is the legacy machine containing the data, shares, and configurations you wish to migrate. The Storage Migration Service can inventory and transfer data from Windows Server 2003 and later, as well as various Linux distributions using SMB, making it a versatile tool.
C
Destination server
The destination server is the new target machine that will receive the migrated data and, eventually, the identity of the source server. It must run a modern version of Windows Server, such as 2019 or 2022, to support the advanced features and protocols used by the service.
D
Azure Relay
Why wrong: Azure Relay is a service used for hybrid connectivity but is not a required component of the core Storage Migration Service architecture. While migrations can occur to Azure VMs, the service itself operates using standard network protocols between the orchestrator, source, and destination without needing a relay.
E
iSCSI Target Server
Why wrong: An iSCSI Target Server provides block-level storage over the network, but it is not a requirement for the Storage Migration Service. The service operates at the file and share level, using SMB to move data between systems regardless of the underlying physical or network storage technology.

Question 5hardmulti select

An administrator needs to capture and analyze network traffic on a Windows Server 2022 Core installation without installing third-party tools. Which TWO steps are necessary to capture traffic using the built-in 'pktmon' tool and prepare it for analysis in Wireshark on another machine?

Trap 1: Use 'netsh trace start' to capture data.

While 'netsh trace' is another built-in method for capturing network data, it is a separate utility from Pktmon. The question specifically asks for the steps related to the Pktmon tool. Mixing these utilities is incorrect as they use different command structures and produce different output formats that require different handling.

Trap 2: Enable 'Promiscuous Mode' in the NIC settings.

Pktmon does not require the physical or virtual network interface to be manually placed in promiscuous mode to capture traffic destined for or originating from the host. It operates at the driver level within the networking stack, capturing packets as they pass through various layers without needing NIC configuration changes.

Trap 3: Run 'pktmon filter add -p 80' to start.

This command adds a filter for port 80 traffic, which is useful for narrowing down the capture, but it does not actually start the capture process. A filter must be followed by the 'start' command to begin recording data. On its own, this step produces no capture file for analysis.

A
Run 'pktmon start --etw' to begin.
This command initiates the packet capture process. The '--etw' flag ensures that the traffic is logged using Event Tracing for Windows, which is the underlying framework Pktmon uses to record network events. This is the standard first step for capturing live traffic data on the server.
B
Run 'pktmon pcapng' to convert the log.
By default, Pktmon saves captures in an .etl format, which is not natively readable by most network analysis tools. The 'pcapng' sub-command converts these logs into the PCAPNG format, allowing the administrator to export the data and analyze it using standard tools like Wireshark on a workstation.
C
Use 'netsh trace start' to capture data.
Why wrong: While 'netsh trace' is another built-in method for capturing network data, it is a separate utility from Pktmon. The question specifically asks for the steps related to the Pktmon tool. Mixing these utilities is incorrect as they use different command structures and produce different output formats that require different handling.
D
Enable 'Promiscuous Mode' in the NIC settings.
Why wrong: Pktmon does not require the physical or virtual network interface to be manually placed in promiscuous mode to capture traffic destined for or originating from the host. It operates at the driver level within the networking stack, capturing packets as they pass through various layers without needing NIC configuration changes.
E
Run 'pktmon filter add -p 80' to start.
Why wrong: This command adds a filter for port 80 traffic, which is useful for narrowing down the capture, but it does not actually start the capture process. A filter must be followed by the 'start' command to begin recording data. On its own, this step produces no capture file for analysis.

Question 6mediummulti select

You are troubleshooting a Windows Server application that occasionally hangs. You want to capture a dump file of the process when it stops responding. Which THREE tools or methods should you consider using? (Choose three.)

Trap 1: Performance Monitor

Performance Monitor is designed to track resource metrics and system counters over time. It lacks the functionality to inspect process memory or generate memory dump files. While it can identify that a process is consuming high resources, it cannot perform the memory capture necessary to debug application hangs.

Trap 2: Resource Monitor

Resource Monitor provides a real-time view of hardware and network usage by specific processes. While it is excellent for visualizing which processes are using the most memory or disk I/O, it does not provide the capability to create or export process memory dump files for debugging application freezes.

A
Task Manager
Task Manager allows for a simple right-click operation to 'Create dump file' for any running process. This is the most accessible method for an administrator to capture the current state of an unresponsive application without requiring additional software installation or complex command-line configuration for simple debugging needs.
B
ProcDump
ProcDump is a powerful command-line utility from the Sysinternals suite that can be configured to monitor a process and automatically generate a dump file based on specific triggers, such as CPU spikes or hang states. It is the industry standard for capturing complex application failures in production environments.
C
Performance Monitor
Why wrong: Performance Monitor is designed to track resource metrics and system counters over time. It lacks the functionality to inspect process memory or generate memory dump files. While it can identify that a process is consuming high resources, it cannot perform the memory capture necessary to debug application hangs.
D
Windows Error Reporting (WER) configuration
Windows Error Reporting can be configured via the registry or Group Policy to automatically create local dump files when an application crashes or hangs. This is a robust, system-wide approach to ensuring diagnostic data is available for analysis even if an administrator is not present during the hang.
E
Resource Monitor
Why wrong: Resource Monitor provides a real-time view of hardware and network usage by specific processes. While it is excellent for visualizing which processes are using the most memory or disk I/O, it does not provide the capability to create or export process memory dump files for debugging application freezes.

Question 7hardmultiple choice

Refer to the exhibit. You are running dcdiag to investigate synchronization issues between two domain controllers. Based on the error code 1256 and the output provided, which action is most likely to resolve the underlying problem?

Exhibit

Testing server: Default-First-Site-Name\DC1
Starting test: Connectivity
   ......................... DC1 passed test Connectivity
Starting test: Replications
   [Replications Check,DC1] A recent replication attempt failed:
   From DC2 to DC1
   Naming Context: DC=contoso,DC=com
   The replication generated an error (1256): The remote system is not available.

Trap 1: Force an immediate KCC topology update using repadmin /kcc.

While forcing a KCC update can sometimes fix logical topology issues, it will not resolve a 'remote system not available' error. This error indicates a communication failure at the network or service level, which the KCC cannot bypass until the underlying transport path is restored.

Trap 2: Reset the computer account password for DC1 in Active Directory.

Resetting a computer account password is used for 'Access Denied' errors or secure channel failures, typically indicated by error 5. It is not appropriate for error 1256, which is a connectivity-based failure rather than a credential or authentication-based failure between the domain controllers.

Trap 3: Seize the FSMO roles from DC2 using ntdsutil.

Seizing FSMO roles is a drastic measure taken only when a domain controller is permanently lost. It does not fix replication errors for the naming context. If the connectivity is temporarily broken, seizing roles would create more complexity and potential conflicts once the network issue is resolved.

A
Force an immediate KCC topology update using repadmin /kcc.
Why wrong: While forcing a KCC update can sometimes fix logical topology issues, it will not resolve a 'remote system not available' error. This error indicates a communication failure at the network or service level, which the KCC cannot bypass until the underlying transport path is restored.
B
Check the network connectivity and power status of DC2.
The error code 1256 specifically suggests that the destination server (DC1) cannot reach the source server (DC2). The most logical first step is to verify that DC2 is powered on, connected to the network, and that no firewalls are blocking the RPC ports required for AD replication.
C
Reset the computer account password for DC1 in Active Directory.
Why wrong: Resetting a computer account password is used for 'Access Denied' errors or secure channel failures, typically indicated by error 5. It is not appropriate for error 1256, which is a connectivity-based failure rather than a credential or authentication-based failure between the domain controllers.
D
Seize the FSMO roles from DC2 using ntdsutil.
Why wrong: Seizing FSMO roles is a drastic measure taken only when a domain controller is permanently lost. It does not fix replication errors for the naming context. If the connectivity is temporarily broken, seizing roles would create more complexity and potential conflicts once the network issue is resolved.

Question 8mediummultiple choice

Refer to the exhibit. You are reviewing the output of a command used to check the health of your domain controllers. Based on the first line of the output, which specific role or feature is currently enabled on this domain controller?

Exhibit

DSA Options: IS_GC
Site: Default-First-Site-Name
...
DC=contoso,DC=com
    Default-First-Site-Name\DC2 via RPC
        DSA object GUID: 550e8400-e29b-41d4-a716-446655440000
        Last attempt @ 2023-10-12 10:00:00 was successful.

Trap 1: Primary Domain Controller (PDC) Emulator

The PDC Emulator role is an Operations Master role and is not identified by the 'IS_GC' string. While a PDC Emulator can also be a Global Catalog, the exhibit specifically highlights the Global Catalog attribute rather than any of the five FSMO roles assigned to the server.

Trap 2: Read-Only Domain Controller (RODC)

A Read-Only Domain Controller would be identified by different flags, such as 'IS_RODC', in the output. The 'IS_GC' flag only tells us about the Global Catalog status and does not indicate whether the domain controller is writeable or read-only in its primary database operation.

Trap 3: Schema Master

The Schema Master is a forest-wide FSMO role. While the server in the exhibit might hold this role, the 'IS_GC' output does not provide evidence of FSMO role ownership. FSMO roles are typically checked using 'netdom query fsmo' or similar PowerShell commands rather than replication status tools.

A
Primary Domain Controller (PDC) Emulator
Why wrong: The PDC Emulator role is an Operations Master role and is not identified by the 'IS_GC' string. While a PDC Emulator can also be a Global Catalog, the exhibit specifically highlights the Global Catalog attribute rather than any of the five FSMO roles assigned to the server.
B
Global Catalog (GC)
The 'IS_GC' flag stands for 'Is Global Catalog'. It confirms that this domain controller holds a partial, read-only copy of all objects in the forest and can perform forest-wide searches and provide universal group membership information during the user authentication and authorization process.
C
Read-Only Domain Controller (RODC)
Why wrong: A Read-Only Domain Controller would be identified by different flags, such as 'IS_RODC', in the output. The 'IS_GC' flag only tells us about the Global Catalog status and does not indicate whether the domain controller is writeable or read-only in its primary database operation.
D
Schema Master
Why wrong: The Schema Master is a forest-wide FSMO role. While the server in the exhibit might hold this role, the 'IS_GC' output does not provide evidence of FSMO role ownership. FSMO roles are typically checked using 'netdom query fsmo' or similar PowerShell commands rather than replication status tools.

Question 9hardmultiple choice

Refer to the exhibit. You are troubleshooting an Azure Arc onboarding failure. The server has an internet connection, but the registration script returns the provided error. What should you verify first?

Exhibit

Error: 0x80072ee7. The Connected Machine agent failed to register with Azure. Connectivity check indicates DNS resolution failure for hybridresource.azure.com.

Trap 1: Verify the Azure Subscription Quotas

Subscription quotas limit the number of resources in a tenant but do not cause DNS resolution errors. If a quota was reached, the error would manifest as an authorization or resource limit failure rather than a connectivity-related DNS lookup issue during the initial registration attempt for the agent.

Trap 2: Validate the Azure Service Principal credentials

Service Principal issues typically result in 'Access Denied' or authentication errors, not DNS resolution failures. Validating credentials is a valid troubleshooting step for identity-related problems, but it does not address the fundamental networking layer issue where the client cannot translate the Azure hostname into an IP address.

Trap 3: Restart the Azure Connected Machine service

Restarting the service might trigger a retry, but it will not fix an underlying DNS configuration issue. If the local resolver is unable to reach the Azure infrastructure, restarting the agent will simply result in the same error message because the root cause of the connectivity failure remains present.

A
Verify the Azure Subscription Quotas
Why wrong: Subscription quotas limit the number of resources in a tenant but do not cause DNS resolution errors. If a quota was reached, the error would manifest as an authorization or resource limit failure rather than a connectivity-related DNS lookup issue during the initial registration attempt for the agent.
B
Check the local DNS server forwarding settings
Since the server cannot resolve the Azure FQDN, the local DNS forwarders are likely misconfigured or restricted. Updating the forwarders to point to public DNS providers or correctly configuring conditional forwarders for Azure domains allows the server to resolve the necessary endpoints to complete the agent registration process.
C
Validate the Azure Service Principal credentials
Why wrong: Service Principal issues typically result in 'Access Denied' or authentication errors, not DNS resolution failures. Validating credentials is a valid troubleshooting step for identity-related problems, but it does not address the fundamental networking layer issue where the client cannot translate the Azure hostname into an IP address.
D
Restart the Azure Connected Machine service
Why wrong: Restarting the service might trigger a retry, but it will not fix an underlying DNS configuration issue. If the local resolver is unable to reach the Azure infrastructure, restarting the agent will simply result in the same error message because the root cause of the connectivity failure remains present.

Question 10hardmultiple choice

You are troubleshooting an issue where an Azure Arc-enabled server is showing as 'Offline' in the Azure portal, despite the server being powered on. Which local service should you check first to ensure the agent is running?

Trap 1: Windows Update service

The Windows Update service is responsible for managing OS patches and is not directly tied to the Azure Arc agent's connectivity status. While updates are important for security, the heartbeat of the Arc-enabled server is independent of the Windows Update service state during normal operation.

Trap 2: Server Manager

Server Manager is an administrative dashboard for local role management and is not a background service related to hybrid connectivity. Its state does not impact the ability of the Azure Arc agent to communicate with the cloud, and checking it provides no insight into the agent's connectivity status.

Trap 3: Network Location Awareness service

This service manages network connectivity states for the OS but is not responsible for the Arc agent's heartbeat. While network connectivity is required, this specific Windows service does not control the registration or agent-to-cloud communication flow for the Azure Connected Machine service itself.

A
Windows Update service
Why wrong: The Windows Update service is responsible for managing OS patches and is not directly tied to the Azure Arc agent's connectivity status. While updates are important for security, the heartbeat of the Arc-enabled server is independent of the Windows Update service state during normal operation.
B
Azure Connected Machine Agent service (himds)
The 'himds' service is the core service for the Azure Connected Machine agent. If this service is not running, the server cannot communicate its status, configuration, or telemetry to Azure. Ensuring this service is in a 'Running' state is the primary step to resolving connectivity issues.
C
Server Manager
Why wrong: Server Manager is an administrative dashboard for local role management and is not a background service related to hybrid connectivity. Its state does not impact the ability of the Azure Arc agent to communicate with the cloud, and checking it provides no insight into the agent's connectivity status.
D
Network Location Awareness service
Why wrong: This service manages network connectivity states for the OS but is not responsible for the Arc agent's heartbeat. While network connectivity is required, this specific Windows service does not control the registration or agent-to-cloud communication flow for the Azure Connected Machine service itself.

Question 11hardmultiple choice

You are troubleshooting an issue where an Azure Arc-enabled server is showing a status of 'Offline' in the Azure portal. Which TWO logs or files should you inspect on the Windows Server? (Choose two.)

Trap 1: C:\Windows\System32\drivers\etc\hosts

While this file controls name resolution, it is rarely the cause of a heartbeat failure unless the administrator has manually modified it to block communication. It is not a log file, and checking it is an advanced troubleshooting step, not a primary location for agent health diagnostics.

Trap 2: C:\Windows\System32\config\SAM

The SAM database stores local user account hashes and is a security-sensitive file. It contains no information regarding the operation, health, or connectivity of the Azure Connected Machine agent. Attempting to inspect this file is useless for troubleshooting and would typically require specialized tools that are not used for Arc.

Trap 3: C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys

This folder contains private keys for machine certificates. While a corruption here could prevent the agent from authenticating, it is not a human-readable log file. Directly inspecting these keys is highly risky and is not a valid way to debug the connectivity status of the Azure Arc agent.

A
C:\ProgramData\AzureConnectedMachineAgent\Log\himds.log
This log file contains the primary output for the Hybrid Instance Metadata Service (HIMDS). It is the source of truth for the agent's internal operations, including token requests and connection attempts. Inspecting this file is the standard first step for diagnosing why a server is not reporting back to Azure.
B
Windows Application Event Log
The Windows Event Log acts as a secondary diagnostic source. If the agent fails due to environmental issues—such as a failure to access the system certificate store or a crash of a dependent Windows service—the error will often be captured here, providing context that the agent's own logs might lack.
C
C:\Windows\System32\drivers\etc\hosts
Why wrong: While this file controls name resolution, it is rarely the cause of a heartbeat failure unless the administrator has manually modified it to block communication. It is not a log file, and checking it is an advanced troubleshooting step, not a primary location for agent health diagnostics.
D
C:\Windows\System32\config\SAM
Why wrong: The SAM database stores local user account hashes and is a security-sensitive file. It contains no information regarding the operation, health, or connectivity of the Azure Connected Machine agent. Attempting to inspect this file is useless for troubleshooting and would typically require specialized tools that are not used for Arc.
E
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys
Why wrong: This folder contains private keys for machine certificates. While a corruption here could prevent the agent from authenticating, it is not a human-readable log file. Directly inspecting these keys is highly risky and is not a valid way to debug the connectivity status of the Azure Arc agent.

Question 12hardmultiple choice

An administrator is troubleshooting a Storage Spaces Direct (S2D) cluster where one node shows a status of 'Retired'. The administrator needs to identify if a physical disk failure or a communication timeout caused this status. Which PowerShell cmdlet provides the most detailed health information regarding the operational status of the underlying physical disks in the storage pool?

Trap 1: Get-StoragePool

This cmdlet provides high-level information about the health and operational status of the entire storage pool rather than individual disks. While it can confirm if the pool is degraded, it lacks the granular detail required to identify specific physical disk failures or the reasons why a particular drive was retired.

Trap 2: Get-VirtualDisk

This command focuses on the health of the logical volumes created on top of the storage pool. Although it will show if a volume is 'Degraded' or 'Incomplete' due to disk issues, it does not provide the hardware-level telemetry needed to diagnose the root cause of an individual physical disk failure.

Trap 3: Debug-StorageSubsystem

This utility is used for broader troubleshooting of storage faults and can help identify why a cluster might be underperforming. While it is a powerful diagnostic tool, it is generally used after identifying a specific component failure rather than as the primary means of checking the basic status of physical hardware.

A
Get-StoragePool
Why wrong: This cmdlet provides high-level information about the health and operational status of the entire storage pool rather than individual disks. While it can confirm if the pool is degraded, it lacks the granular detail required to identify specific physical disk failures or the reasons why a particular drive was retired.
B
Get-PhysicalDisk
This cmdlet retrieves the status of every physical disk visible to the storage subsystem. It displays critical properties such as HealthStatus, OperationalStatus, and Usage. This is the primary tool for identifying which specific drive has failed or been marked as retired within an S2D cluster or a standard storage pool.
C
Get-VirtualDisk
Why wrong: This command focuses on the health of the logical volumes created on top of the storage pool. Although it will show if a volume is 'Degraded' or 'Incomplete' due to disk issues, it does not provide the hardware-level telemetry needed to diagnose the root cause of an individual physical disk failure.
D
Debug-StorageSubsystem
Why wrong: This utility is used for broader troubleshooting of storage faults and can help identify why a cluster might be underperforming. While it is a powerful diagnostic tool, it is generally used after identifying a specific component failure rather than as the primary means of checking the basic status of physical hardware.

Review the full subnetting walkthrough →

Question 13mediummultiple choice

Users report that they cannot access a shared folder on a Windows Server 2022 instance located in a different subnet. You suspect a firewall or routing issue. Which PowerShell cmdlet should you use to test both ICMP connectivity and the specific TCP port 445 availability simultaneously?

Trap 1: Ping -t

The ping command only tests ICMP connectivity, which many firewalls block by default while still allowing service traffic. Ping cannot verify if a specific TCP port like 445 (SMB) is open, making it insufficient for determining if the file sharing service is actually reachable across the network.

Trap 2: Resolve-DnsName

Resolve-DnsName is used to troubleshoot DNS resolution issues by querying name servers for records. While DNS is necessary for connecting to a server by name, this cmdlet does not test network connectivity or port availability, which are the primary concerns when a server's IP is already known.

Trap 3: Get-NetFirewallRule

Get-NetFirewallRule is used to inspect the local firewall configuration on the server where the command is run. It does not test connectivity to a remote server or verify if intermediate network devices, such as hardware firewalls or routers, are blocking traffic between the client and the destination.

A
Ping -t
Why wrong: The ping command only tests ICMP connectivity, which many firewalls block by default while still allowing service traffic. Ping cannot verify if a specific TCP port like 445 (SMB) is open, making it insufficient for determining if the file sharing service is actually reachable across the network.
B
Resolve-DnsName
Why wrong: Resolve-DnsName is used to troubleshoot DNS resolution issues by querying name servers for records. While DNS is necessary for connecting to a server by name, this cmdlet does not test network connectivity or port availability, which are the primary concerns when a server's IP is already known.
C
Get-NetFirewallRule
Why wrong: Get-NetFirewallRule is used to inspect the local firewall configuration on the server where the command is run. It does not test connectivity to a remote server or verify if intermediate network devices, such as hardware firewalls or routers, are blocking traffic between the client and the destination.
D
Test-NetConnection
Test-NetConnection allows you to specify a destination and a port (e.g., -Port 445). It performs a TCP handshake to verify the service is listening and also provides ICMP statistics and route tracing, making it the most effective tool for diagnosing cross-subnet connectivity issues for specific services.

Question 14hardmultiple choice

An administrator reports that Active Directory changes made on DC01 are not appearing on DC02. You suspect a replication issue. Which tool and command provide the most comprehensive output regarding the status of all replication neighbors for a specific domain controller?

Trap 1: Active Directory Sites and Services - 'Check Replication Topology'

While Sites and Services allows you to manually trigger replication and check the topology, it does not provide a detailed, historical report of replication failures or specific error codes in a single consolidated view. It is more of a management interface than a deep troubleshooting and diagnostic tool.

Trap 2: dcdiag /test:Replication

Dcdiag is a diagnostic tool that runs a battery of tests against a domain controller. While the replication test is useful for identifying if a problem exists, it often provides less granular detail about individual neighbor status compared to the specific and targeted output of the 'repadmin /showrepl' command.

Trap 3: Get-ADReplicationPartnerMetadata

This PowerShell cmdlet provides similar information to repadmin, but 'repadmin /showrepl' is the traditional and most widely used tool for this specific task in Windows Server administration. Repadmin output is often preferred by administrators for its concise and comprehensive formatting when troubleshooting immediate replication failures.

A
Active Directory Sites and Services - 'Check Replication Topology'
Why wrong: While Sites and Services allows you to manually trigger replication and check the topology, it does not provide a detailed, historical report of replication failures or specific error codes in a single consolidated view. It is more of a management interface than a deep troubleshooting and diagnostic tool.
B
repadmin /showrepl DC02
The 'repadmin /showrepl' command displays the replication status for the specified domain controller. It lists every naming context, the neighbors from which it replicates, the time of the last success, and the specific error message for any failures, making it the best tool for diagnosing sync issues.
C
dcdiag /test:Replication
Why wrong: Dcdiag is a diagnostic tool that runs a battery of tests against a domain controller. While the replication test is useful for identifying if a problem exists, it often provides less granular detail about individual neighbor status compared to the specific and targeted output of the 'repadmin /showrepl' command.
D
Get-ADReplicationPartnerMetadata
Why wrong: This PowerShell cmdlet provides similar information to repadmin, but 'repadmin /showrepl' is the traditional and most widely used tool for this specific task in Windows Server administration. Repadmin output is often preferred by administrators for its concise and comprehensive formatting when troubleshooting immediate replication failures.